Thank you MS :( | Porn Fan Community Forum

New Pornstar Interviews - [more]

Little Puck Interview

"I’m a woman of varied tastes. I can get off to a lot of different things. I enjoy switching it up."

Participate...

log in
register

Browse...

Etiquette
Active Topics
Popular Topics
Member List
Search

All Forums > Tech Talk > Tech Talk Forum Page 59 > Thank you MS :(

Author	Post
cubesnake Senior Member 3858 Posts 10/02	Posted - Feb 11 2004 : 9:47AM Hi, Today i discovered a rather strange thing on my PC. After my last two updates from MS i can no longer have urls like this http://username:password@www.blabla.com all i get is wrong syntax Username and pass are valid ! It looks like Ms "bend" something within the Internet Explorer I guess the old saying "never change a running system" is true after all Cube [Link]
GaySatyr Senior Member Half dirty ol' man; half horny ol' goat! 1684 Posts 10/00	Posted - Feb 11 2004 : 9:51AM I realize that this is an inconvenience for you; however, it was to great a convenience for way too many hackers. Microsoft disabled this particular feature for a very good reason. There are other ways to store or automate password usage that are safer but the best way is to remember your passwords and enter them manually. ~ GaySatyr [Link]
Saki At-Large 2087 Posts 11/99	Posted - Feb 11 2004 : 10:00AM Here's why the update is important. An excerpt: This is how it works: The actual URL syntax in the link--which appears in the IE address bar, when the link is clicked, and also at the bottom of the IE window, when someone rolls over the link with the cursor--looks like this: http(s)://username:password@server/resource.ext. The browser uses whatever is to the right of the @ symbol to locate the Web page. Everything to the left of the @ is used to authenticate the user. If there is no authentication mechanism available on the targeted page, the beginning part of the URL is ignored. Attackers, then, can use the area to the left of the @ symbol to create a fake Web address and fool victims into going to a different page or site. For instance, the URL http://www.cnet.com@mysimon.com looks like it will go to the Web site http://www.cnet.com, but it actually goes to http://mysimon.com. The problem has been exacerbated by a recently discovered bug in the URL display of Internet Explorer browsers. By adding a few special characters in front of the @, an attacker can prevent the browser from displaying the true destination address of the URL. So, for instance, in the above example, the URL in the IE address bar and at the bottom of the IE window would appear as simply http://www.cnet.com. After users install the new patch, IE will no longer recognize links coded with usernames and passwords and will send surfers to a Web page that displays an "Invalid syntax error" message. Microsoft hasn't said when the patch will be available, but the company has released a support document to help explain how coders of links can work around the new change. (CNET) Click to expand - Saki [faqs] [Link]
Saki At-Large 2087 Posts 11/99	Posted - Feb 11 2004 : 10:09AM So a hypothetical example of why the vulnerability needed to be fixed: a malicious web site or e-mail pretends it's a link to your favorite shopping site. You click on it. The URL looks valid. The attacker has replicated the site design down to the last detail. You decide to buy the product, enter your credit card details, and a few weeks later your bank calls you and tells you that they've noticed suspicious charges to your account. Another: You receive an e-mail purporting to be from your bank or an online payment service. "Please log in and check your mailing address and ensure that it's correct." You click, you see that sure enough, it says "www.mybank.com." You enter your userid and password. Behind the scenes, the attacker records this info, redirects the logon to your real bank, and you're none the wiser, since your bank then displays your real account information. That's the reason why ignoring Microsoft updates (when they get around to issuing them) is a Very Bad Thing. - Saki [faqs] [Link]
skullman80 Member Pittsburgh, Pa 23 Posts 1/04	Posted - Feb 15 2004 : 12:35PM cubesnake, If you want the fix to the fix MS put out...I can email it to you... [Link]

PL Senior Member God hates us all, you know it's true, God hates this place. - Slayer 1726 Posts 10/03	Posted - Feb 15 2004 : 3:16PM Well that method works in Mozilla, Cube...better browser anyway [Link]
cubesnake Senior Member 3858 Posts 10/02	Posted - Feb 15 2004 : 6:02PM Hi, skullman80 wrote: cubesnake, If you want the fix to the fix MS put out...I can email it to you... Click to expand thanks for your offer ... somebody else already helped me. And after reading on the Ms site i found the help myself :)) Cube [Link]

All Forums > Tech Talk > Tech Talk Forum Page 59Thank you MS :(

Previous topic: Lindows now Lindash
Next topic: Collibarating monitor

Link to this post

Use the code below to link to this topic or a specific post.

URL of this thread

Link to this post with HTML

Link to this post with Forum Code